{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,11,21]],"date-time":"2025-11-21T06:02:32Z","timestamp":1763704952311,"version":"3.40.4"},"reference-count":40,"publisher":"Wiley","issue":"4","license":[{"start":{"date-parts":[[2014,6,5]],"date-time":"2014-06-05T00:00:00Z","timestamp":1401926400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/linproxy.fan.workers.dev:443\/http\/onlinelibrary.wiley.com\/termsAndConditions#vor"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Int J Network Mgmt"],"published-print":{"date-parts":[[2014,7]]},"abstract":"<jats:title>SUMMARY<\/jats:title><jats:p>Analyzing the composition of Internet traffic has many applications nowadays, like tracking bandwidth\u2010consuming applications, QoS\u2010based traffic engineering and lawful interception of illegal traffic. Even though many flow\u2010based classification methods, such as support vector machines (SVM), have demonstrated their accuracy, few practical implementations of lightweight classifiers exist. We consider in this paper the design of a real\u2010time SVM traffic classifier at hundreds of Gb\/s to allow online detection of categories of applications. We also implement a high\u2010speed flow reconstruction algorithm able to handle one million concurrent flows. The solution is based on the massive parallelism and low\u2010level network interface access of FPGA boards. We find maximum supported bit rates up to 408 Gb\/s for classification and up to 20 GB\/s for flow reconstruction for the most challenging trace. Results are confirmed using a commercial Combov2 board with a Virtex 5 FPGA. Copyright \u00a9 2014 John Wiley &amp; Sons, Ltd.<\/jats:p>","DOI":"10.1002\/nem.1863","type":"journal-article","created":{"date-parts":[[2014,6,5]],"date-time":"2014-06-05T06:09:45Z","timestamp":1401948585000},"page":"253-271","source":"Crossref","is-referenced-by-count":5,"title":["High\u2010speed flow\u2010based classification on FPGA"],"prefix":"10.1002","volume":"24","author":[{"given":"Tristan","family":"Grol\u00e9at","sequence":"first","affiliation":[{"name":"Computer Science Department, T\u00e9l\u00e9com Bretagne France"}]},{"given":"Sandrine","family":"Vaton","sequence":"additional","affiliation":[{"name":"Computer Science Department, T\u00e9l\u00e9com Bretagne France"}]},{"given":"Matthieu","family":"Arzel","sequence":"additional","affiliation":[{"name":"Electronics Department, T\u00e9l\u00e9com Bretagne France"}]}],"member":"311","published-online":{"date-parts":[[2014,6,5]]},"reference":[{"unstructured":"Cisco Systems.Cisco Visual Networking Index: Forecast and Methodology 2010. Cisco Systems: San Jose CA.","key":"e_1_2_9_2_1"},{"doi-asserted-by":"crossref","unstructured":"XueY WangD ZhangL.Traffic classification: issues and challenges InInternational Conference on Computing Networking and Communications (ICNC \u201913) San Diego USA 2013;545\u2013549.","key":"e_1_2_9_3_1","DOI":"10.1109\/ICCNC.2013.6504144"},{"doi-asserted-by":"crossref","unstructured":"RoughanMM SenS SpatscheckO DuffieldN.Class\u2010of\u2010service mapping for QoS: a statistical signature\u2010based approach to IP traffic classification InProceedings of the 4th ACM SIGCOMM Conference on Internet Measurement (IMC \u201904) Taormina Italy 2004;135\u2013148.","key":"e_1_2_9_4_1","DOI":"10.1145\/1028788.1028805"},{"doi-asserted-by":"crossref","unstructured":"HaffnerP SenS SpatscheckO WangD.ACAS: automated construction of application signatures InSIGCOMM 2005 MineNet Workshop Philadelphia USA 2005.","key":"e_1_2_9_5_1","DOI":"10.1145\/1080173.1080183"},{"doi-asserted-by":"crossref","unstructured":"KimH BarmanD FaloutsosM FomenkovM LeeK.Internet traffic classification demystified: the myths caveats and best practices InProceedings of ACM CoNEXT Madrid Spain 2008.","key":"e_1_2_9_6_1","DOI":"10.1145\/1544012.1544023"},{"doi-asserted-by":"crossref","unstructured":"LimY\u2010s KimH\u2010c JeongJ KimC\u2010k KwonTT ChoiY.Internet traffic classification demystified: on the sources of the discriminative power InProceedings of ACM CoNEXT New York USA 2010;9:1\u20139:12.","key":"e_1_2_9_7_1","DOI":"10.1145\/1921168.1921180"},{"doi-asserted-by":"publisher","key":"e_1_2_9_8_1","DOI":"10.1145\/1163593.1163596"},{"doi-asserted-by":"crossref","unstructured":"GroleatT ArzelM VatonS.Hardware acceleration of SVM\u2010based traffic classification on FPGA InWireless Communications and Mobile Computing Conference (IWCMC \u201912) Limassol Cyprus 2012;443\u2013449.","key":"e_1_2_9_9_1","DOI":"10.1109\/IWCMC.2012.6314245"},{"doi-asserted-by":"publisher","key":"e_1_2_9_10_1","DOI":"10.1109\/TNN.2006.877537"},{"unstructured":"Grol\u00e9atT.Hardware traffic classifier. Available:https:\/\/linproxy.fan.workers.dev:443\/https\/github.com\/tristan\u2010TB\/hardware\u2010traffic\u2010classifier[7 May 2014].","key":"e_1_2_9_11_1"},{"unstructured":"GomezG BelzarenaP.Early traffic classification using support vector machines InFifth International Latin American Networking Conference (LANC \u201909) Pelotas Brazil 2009.","key":"e_1_2_9_12_1"},{"doi-asserted-by":"publisher","key":"e_1_2_9_13_1","DOI":"10.1016\/j.comnet.2009.05.003"},{"doi-asserted-by":"crossref","unstructured":"TongD SunL MatamK PrasannaV.High throughput and programmable online traffic classifier on FPGA InProceedings of the ACM\/SIGDA International Symposium on Field Programmable Gate Arrays Monterey USA 2013;255\u2013264.","key":"e_1_2_9_14_1","DOI":"10.1145\/2435264.2435307"},{"doi-asserted-by":"crossref","unstructured":"EsteA GringoliF.On\u2010line SVM traffic classification InProceedings of the 7th IWCMC Conference (IWCMC TRAC \u20192011) Istanbul Turkey 2011.","key":"e_1_2_9_15_1","DOI":"10.1109\/IWCMC.2011.5982804"},{"doi-asserted-by":"crossref","unstructured":"GringoliF NavaL EsteA SalgarelliL.MTCLASS: enabling statistical traffic classification of multi\u2010gigabit aggregates on inexpensive hardware InProceedings of the 8th IWCMC Conference (TRAC) Limassol Cyprus 2012.","key":"e_1_2_9_16_1","DOI":"10.1109\/IWCMC.2012.6314246"},{"doi-asserted-by":"crossref","unstructured":"Santiago del RioMP RossiD GringoliF NavaL SalgarelliL AracilJ.Wire\u2010speed statistical classification of network traffic on commodity hardware InProceedings of the 2012 ACM Conference on Internet Measurement Conference Boston USA 2012;65\u201372.","key":"e_1_2_9_17_1","DOI":"10.1145\/2398776.2398784"},{"unstructured":"DeriL NekitosSPA KmVDB FigurettaLL.Improving passive packet capture: beyond device polling InProceedings of SANE Amsterdam Netherlands 2004;85\u201393.","key":"e_1_2_9_18_1"},{"unstructured":"RizzoL.Netmap: a novel framework for fast packet i\/o InProceedings of the 2012 USENIX Conference on Annual Technical Conference Bellevue USA 2012;101\u2013112.","key":"e_1_2_9_19_1"},{"unstructured":"Intel. DPDK. Available:https:\/\/linproxy.fan.workers.dev:443\/http\/dpdk.org\/[7 May 2014].","key":"e_1_2_9_20_1"},{"unstructured":"NetFPGA: a line\u2010rate.flexible and open platform for research. Available:https:\/\/linproxy.fan.workers.dev:443\/http\/netfpga.org\/[7 May 2014].","key":"e_1_2_9_21_1"},{"unstructured":"Invea\u2010Tech.FPGA cards. Available:https:\/\/linproxy.fan.workers.dev:443\/https\/www.invea.com\/en\/products\u2010and\u2010services\/fpga\u2010cards[19 May 2014].","key":"e_1_2_9_22_1"},{"doi-asserted-by":"publisher","key":"e_1_2_9_23_1","DOI":"10.1109\/SURV.2011.072210.00075"},{"doi-asserted-by":"crossref","unstructured":"ClaiseB.Cisco Systems NetFlow Services Export Version 9 InRFC 3954 2004.","key":"e_1_2_9_24_1","DOI":"10.17487\/rfc3954"},{"unstructured":"MartinZ.NetFlow probe on NetFPGA (December 2008). Available:https:\/\/linproxy.fan.workers.dev:443\/http\/www.liberouter.org\/~xzadni00\/netflowprobedoc.pdf[7 May 2014].","key":"e_1_2_9_25_1"},{"doi-asserted-by":"publisher","key":"e_1_2_9_26_1","DOI":"10.1145\/1090191.1080114"},{"doi-asserted-by":"publisher","key":"e_1_2_9_27_1","DOI":"10.1145\/1384529.1375472"},{"doi-asserted-by":"publisher","key":"e_1_2_9_28_1","DOI":"10.1007\/BF00994018"},{"doi-asserted-by":"crossref","unstructured":"BoserBE GuyonIM VapnikVN.A training algorithm for optimal margin classifiers InProceedings of the 5th Annual ACM Workshop on Computational Learning Theory Pittsburgh USA 1992;144\u2013152.","key":"e_1_2_9_29_1","DOI":"10.1145\/130385.130401"},{"doi-asserted-by":"crossref","unstructured":"ChangCC LinCJ.LIBSVM: a library for support vector machines Vol.\u20092 2011.","key":"e_1_2_9_30_1","DOI":"10.1145\/1961189.1961199"},{"unstructured":"Clear Foundation.l7\u2010filter: application layer packet classifier for Linux. Available:https:\/\/linproxy.fan.workers.dev:443\/http\/l7\u2010filter.clearfoundation.com\/[7 May 2014].","key":"e_1_2_9_31_1"},{"doi-asserted-by":"publisher","key":"e_1_2_9_32_1","DOI":"10.1145\/1629607.1629610"},{"unstructured":"HansonTD.Ut hash. Available:https:\/\/linproxy.fan.workers.dev:443\/http\/troydhanson.github.com\/uthash\/[7 May 2014].","key":"e_1_2_9_33_1"},{"doi-asserted-by":"publisher","key":"e_1_2_9_34_1","DOI":"10.1109\/99.660313"},{"unstructured":"CAIDA.The CAIDA UCSD statistical information for the CAIDA anonymized internet traces. Available:https:\/\/linproxy.fan.workers.dev:443\/http\/www.caida.org\/data\/passive\/passive_trace_statistics.xml[7 May 2014].","key":"e_1_2_9_35_1"},{"doi-asserted-by":"publisher","key":"e_1_2_9_36_1","DOI":"10.1016\/j.jalgor.2003.12.002"},{"issue":"1","key":"e_1_2_9_37_1","doi-asserted-by":"crossref","first-page":"58","DOI":"10.1016\/j.jalgor.2003.12.001","article-title":"An improved data stream summary: the count\u2010min sketch and its applications","volume":"55","author":"Cormode G","year":"2005","journal-title":"Journal of Algorithms"},{"key":"e_1_2_9_38_1","first-page":"919","article-title":"FPGA implementation of MD5 hash algorithm","volume":"2","author":"Deepakumara J","year":"2001","journal-title":"Canadian Conference on Electrical and Computer Engineering"},{"doi-asserted-by":"crossref","unstructured":"AndrakaR.A survey of CORDIC algorithms for FPGA based computers InProceedings of the 1998 ACM\/SIGDA Sixth International Symposium on Field Programmable Gate Arrays New York USA 1998;191\u2013200.","key":"e_1_2_9_39_1","DOI":"10.1145\/275107.275139"},{"doi-asserted-by":"publisher","key":"e_1_2_9_40_1","DOI":"10.1109\/TNN.2003.816033"},{"unstructured":"AT&T.Global IP network latency (2013). Available:https:\/\/linproxy.fan.workers.dev:443\/http\/ipnetwork.bgtmo.ip.att.net\/pws\/network_delay.html[7 May 2014].","key":"e_1_2_9_41_1"}],"container-title":["International Journal of Network Management"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/linproxy.fan.workers.dev:443\/https\/api.wiley.com\/onlinelibrary\/tdm\/v1\/articles\/10.1002%2Fnem.1863","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/linproxy.fan.workers.dev:443\/https\/api.wiley.com\/onlinelibrary\/tdm\/v1\/articles\/10.1002%2Fnem.1863","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/linproxy.fan.workers.dev:443\/https\/onlinelibrary.wiley.com\/doi\/pdf\/10.1002\/nem.1863","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,5,3]],"date-time":"2025-05-03T07:07:37Z","timestamp":1746256057000},"score":1,"resource":{"primary":{"URL":"https:\/\/linproxy.fan.workers.dev:443\/https\/onlinelibrary.wiley.com\/doi\/10.1002\/nem.1863"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2014,6,5]]},"references-count":40,"journal-issue":{"issue":"4","published-print":{"date-parts":[[2014,7]]}},"alternative-id":["10.1002\/nem.1863"],"URL":"https:\/\/linproxy.fan.workers.dev:443\/https\/doi.org\/10.1002\/nem.1863","archive":["Portico"],"relation":{},"ISSN":["1055-7148","1099-1190"],"issn-type":[{"type":"print","value":"1055-7148"},{"type":"electronic","value":"1099-1190"}],"subject":[],"published":{"date-parts":[[2014,6,5]]}}}